risex-exchange[.]xyz

The domain risex-exchange.xyz was registered on 20 July 2026 through Unstoppable Domains Inc. and is delegated to the authoritative nameservers ns1.unstoppabledomains.com and ns2.unstoppabledomains.com. Within a day of registration the domain resolved to the IPv4 address 186.2.175.103, and as of the report date (21 July 2026) it remains active. VirusTotal analysis shows that one of ninety-five scanning engines flagged the domain as malicious, indicating that at least one security vendor has identified suspicious activity associated with the host. The same domain appears on a single external blocklist and is actively blocked by the PhishDestroy service, further corroborating its classification as a phishing infrastructure. The rapid creation‑to‑activation timeline, combined with the use of a blockchain‑friendly registrar, suggests an intent to exploit the brief window before takedown actions can be applied. The hosting IP address has not been publicly linked to any known benign services, and no additional telemetry such as SSL certificates, HTTP status codes, or page titles has been disclosed, leaving the exact content of the site unverified. Consequently, while the presence of a vendor detection and blocklist listing confirms a high risk posture, the precise phishing payload or targeted brand cannot be determined from the current evidence. Defenders should prioritize immediate containment by adding risex-exchange.xyz to DNS‑level deny lists and ensuring that email gateways block any URLs or attachments referencing the domain. Continuous monitoring of DNS query logs for the IP 186.2.175.103 is advised to detect lateral use of the same host. If possible, investigators should request a full content capture from the endpoint to enrich the intelligence profile and support attribution efforts. Until additional indicators are obtained, the domain should be treated as an active, high‑confidence phishing vector.